Add per-slot CRC + campaign crash-resume (DOE-RESUME-COUNT)

FABRIC-3.md §XXXV.12: closes two real gaps found by walking the disk-to-
PDF pipeline end to end. (1) doe_trial_slot_t had no integrity check of
its own -- 64 slots share one devblock via a read-modify-write, so a
crash mid-write to any slot could silently corrupt its siblings with
nothing to catch it. Added an 8-byte CRC (same discipline the control
header already had), computed/verified the same way. (2) The campaign
itself had no crash-resume -- a reboot always restarted the whole
18-trial loop from index 0 even with good persisted data already on
disk. Since the trial matrix is fully deterministic from (seed, n-reps),
resuming needs no persisted "which trials ran" state, just a count:
DOE-RESUME-COUNT (new kernel primitive, same pattern as
DOE-PERSIST-TRIAL) walks the ring counting CRC-valid records for a given
ISA; MU-EXEC-CAMPAIGN's signature changes to accept a start-idx and seeds
MU-RUN-ID/the DO loop from it. Each RUN-*-CAMPAIGN entry word now calls
DOE-RESUME-COUNT before launching. Both block-namespace-checked to fit
existing headroom before committing to the design -- no new blocks
needed.

Real bug caught by the build, not shipped: an implicit compiler-inserted
alignment byte before slot_crc silently broke the hand-computed trailing
pad size (doe_trial_slot_size_check failed to compile). Fixed with an
explicit alignment field, matching log_slot_t's own zero-implicit-
padding discipline.

extract_doe_region.py now verifies both CRCs with the REAL CRC-64/XZ
algorithm from block_subsystem.c's compute_crc64() (ported and verified
bit-for-bit against a native C reference this session), replacing
§XXXV.11's incorrect guessed implementation.

Verified: clean compile on all 3 ISAs (amd64/aarch64/riscv64 -- amd64
verified via isolated build only, not boot, since the real per-ISA
campaign is currently live on the only QEMU instance this project's own
rule allows), both capsules pass mkcapsule --lint, CRC64 bit-exact via
native reference. Live boot-verification explicitly deferred until that
campaign finishes or is interrupted -- not claimed as tested when it
wasn't. Found (not missed) a real compatibility consequence: the running
campaign's data is in the old pre-CRC format, so it reads as "corrupt"
under the new extractor and DOE-RESUME-COUNT will resume it from 0, not
mid-campaign -- no data loss, cheap redundant re-run of ~1-2 trials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-17T20:52:35Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-17T23:14:24Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->
@@ -27,8 +27,8 @@
 | `init-l8-volatile.4th` | 4810, 4811, 4812, 4813 | `0x98caabbbd92abac4` | yes |
 | `init.4th` | 2049, 2050, 2057 | `0x1ef4939ed32ec1e6` | yes |
 | `lib.4th` | 4050 | `0x4b216635c359ef73` | yes |
-| `multiuser-doe.4th` | 5044, 5045, 5046, 5047, 5048, 5049, 5050, 5051, 5052, 5053, 5054, 5055 | `0xaef05d0fd502fdc4` | yes |
-| `per-isa-doe.4th` | 5117, 5118, 5119 | `0x369a7c1cad0c3a7b` | yes |
+| `multiuser-doe.4th` | 5044, 5045, 5046, 5047, 5048, 5049, 5050, 5051, 5052, 5053, 5054, 5055 | `0x02a3207dc32d3f4c` | yes |
+| `per-isa-doe.4th` | 5117, 5118, 5119 | `0xf242f32596368fc0` | yes |
 | `process.4th` | 4300, 4301 | `0x781afc1dbd0294f7` | yes |
 | `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` | yes |
 | `turtle.4th` | 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108 | `0x4d470418ca543365` | yes |
@@ -377,18 +377,18 @@
 | 5041 | `common:messaging.4th` | `0x201cfd6d39fcb22d` | ok |
 | 5042 | `common:messaging.4th` | `0x201cfd6d39fcb22d` | ok |
 | 5043 | `workload-calib1.4th` | `0x3b9f2d17b554fabc` | ok |
-| 5044 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5045 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5046 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5047 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5048 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5049 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5050 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5051 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5052 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5053 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5054 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
-| 5055 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok |
+| 5044 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5045 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5046 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5047 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5048 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5049 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5050 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5051 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5052 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5053 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5054 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
+| 5055 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok |
 | 5056 | `workload-5-lite.4th` | `0xea0303f38824f254` | ok |
 | 5057 | `workload-5-lite.4th` | `0xea0303f38824f254` | ok |
 | 5058 | `workload-1-lite.4th` | `0x44a7a7e3176dcc8d` | ok |
@@ -410,9 +410,9 @@
 | 5114 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok |
 | 5115 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok |
 | 5116 | `hermes:init.4th` | `0x2df61924448a6812` | ok |
-| 5117 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok |
-| 5118 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok |
-| 5119 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok |
+| 5117 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok |
+| 5118 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok |
+| 5119 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok |
 
 ## Conflicts
 

capsules/multiuser-doe.4th

@@ -155,14 +155,15 @@ Block 5054
   MU-RUN-ID @ 1+ MU-RUN-ID ! ;
 
 Block 5055
-: MU-EXEC-CAMPAIGN ( seed n-reps -- )
+: MU-EXEC-CAMPAIGN ( seed n-reps start-idx -- )
+  >R
   DUP MU-NREPS !
   MU-N-CFG * MU-N-RUNS !
   SEED
   MU-INIT-MATRIX MU-SHUFFLE
   HB-ON
-  0 MU-RUN-ID !
-  MU-N-RUNS @ 0 DO
+  R@ MU-RUN-ID !
+  MU-N-RUNS @ R> DO
     I MU-CAMPAIGN-STEP
   LOOP
   HB-OFF

capsules/per-isa-doe.4th

@@ -39,10 +39,13 @@ Block 5119
 ( boots, never auto-chained here. )
 : RUN-AMD64-CAMPAIGN ( -- )
   S" amd64" PER-ISA-TAG!
-  AMD64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ;
+  AMD64-SEED PER-ISA-NREPS
+  S" amd64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ;
 : RUN-AARCH64-CAMPAIGN ( -- )
   S" aarch64" PER-ISA-TAG!
-  AARCH64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ;
+  AARCH64-SEED PER-ISA-NREPS
+  S" aarch64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ;
 : RUN-RISCV64-CAMPAIGN ( -- )
   S" riscv64" PER-ISA-TAG!
-  RISCV64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ;
+  RISCV64-SEED PER-ISA-NREPS
+  S" riscv64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ;